What we keep, and what we don’t.
The short version: your email, your display name, the dispatches you file. We don’t sell any of it.
Last updated: October 2026
Who’s responsible
ReviewMyBrand is the data controller for information you give us. Reach us at desk@reviewmybrand.com for any privacy request — access, correction, deletion, or export.
What we collect
- Account info: email, display name, hashed password.
- Dispatches: the rating, title, body, date, and the brand it’s filed under.
- Session cookies: a signed login token and a non-sensitive cookie carrying your display name for the header.
- Basic server logs: IP, user agent, requested URL, timestamp — kept for 30 days for abuse prevention.
What we don’t collect
- No cross-site tracking pixels.
- No ad network tags.
- No sale of personal data to third parties, ever.
How dispatches appear
A dispatch is published with your display name — the one you set at sign-up. Your email is never shown. If you delete your account your dispatches stay on the record but your name is replaced with “Former reader.” If you’d rather we remove them too, email us.
Cookies
Two first-party cookies: the login session (rmb_session, httpOnly, 30 days) and a display-name cookie (rmb_user, 30 days) that lets the header say hello by name without a round-trip. No third-party cookies.
Your rights (UK/EU readers)
- Ask for a copy of what we hold on you.
- Ask us to correct or delete it.
- Ask us to export it in a portable format.
- Complain to the ICO if you think we’ve got it wrong.
Security
Passwords are stored only as bcrypt hashes. Session tokens are HS256-signed with a secret held in server env. Transport is HTTPS end-to-end. We don’t store payment card data.
Changes
We’ll flag material changes to this notice at the top of the page for 30 days before they take effect.